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SUBJECT:  Management  Control  (MC)  Program  Procedures 


References: 


(a)  DoD  Directive  5010.38,  “Management  Control  Program,” 

(b)  Section  35 12  of  title  3 1 ,  United  States  Code  (also  referred  to  as  Public  Law  97- 
255  and  the  Federal  Managers'  Financial  Integrity  Act  (FMFIA)  of  1982) 

(c)  Office  of  Management  and  Budget  (0MB)  Circular  No.  A- 1 23 
(Revised),“Management  Accountability  and  Control,”  June  21, 1995 

(d)  Office  of  Management  and  Budget  Circular  A-127  (Revised),  ‘Einancial  Man¬ 
agement  Systems,”  July  23, 1993 

(e)  through  (s),  see  enclosure  1 


A.  PURPOSE 


This  Instruction: 

1 .  Implements  policy,  assigns  responsibilities,  and  prescribes  procedures  under  reference  (a) 
for  implementation  and  use  of  MC  programs. 

2.  Implements  references  (b)  and  (c). 

B.  APPLICABILITY 

This  Instruction  applies  to  the  Office  of  the  Secretary  of  Defense  (OSD),  the  Military  Depart¬ 
ments,  the  Chairman  of  the  Joint  Chiefs  of  Staff,  the  Unified  Combatant  Commands,  the  Inspector 
General  of  the  Department  of  Defense  (IG,  DoD),  the  Uniformed  Services  University  of  the 
Health  Sciences,  the  Defense  Agencies  and  DoD  Field  Activities  (hereafter  referred  to  collectively 
as  “the  DoD  Components”). 

C.  POLICY 

It  is  DoD  policy  under  reference  (a)  that  a  MC  Program  be  established  to  review,  evaluate  and 
report  on  the  effectiveness  of  MCs  in  the  Department  of  Defense,  and  to  take  appropriate  action 
to  identify  and  correct  ineffective  MCs  and  to  establish  MCs  when  warranted. 


D.  RESPONSIBILITIES 


1 .  The  Under  Secretary  of  Defense  fComptroUert  shall  monitor  compliance  with  this  In¬ 
struction  and  DoD  Directive  5010.38  (reference  (a)). 

2.  The  Under  Secretaries  and  Assistant  Secretaries  of  Defense,  as  Heads  of  Office  of  the 
Secretary  of  Defense  Functional  Elements,  shall  identify  systemic  MC  weaknesses  in  their  func¬ 
tional  areas  that  should  be  reported  by  a  DoD  Component,  and  review  the  reported  actions  of  the 
DoD  Components  that  pertain  to  their  area  of  functional  responsibility  (reference  (a),  subsection 
E.3.). 

3.  The  Heads  of  the  DoD  Components  shall  establish  and  maintain  their  MC  Program  and 
ensure  compliance  with  this  Instruction  and  reference  (a). 

E.  PROCEDURES 

1.  Each  DoD  Component  shall  develop  a  MC  Program  that  shall  include  the  following  ele¬ 
ments: 


a.  Establish  a  MC  process.  After  management  has  developed  and  established  MCs,  as 
required  by  reference  (a)  and  31  U.S.C.  3512  (reference  (b)),  a  MC  process  shall  be  established 
that  win  conclude  with  the  reporting  of  management’s  opinion  about  the  effectiveness  of  its  MCs. 
This  process  includes,  as  appropriate;  assigning  responsibilities  and  providing  personnel  for 
planning,  directing  and  executing  the  MC  Program;  developing  internal  reporting  and  tracking 
capabilities;  ensuring  periodic  evaluations  of  MCs  (“continuously  monitor...”  Circular  A-123 
(reference  (c));  and  maintaining  appropriate  documentation. 

b.  Segment  along  organizational,  functional,  or  programmatic  lines  into  assessable  units 
(or  appropriate  alternative  methodology  providing  equivalent  results  while  identifying  vital  con¬ 
trols).  Each  DoD  Component  shall  establish  and  maintain  an  inventory  of  its  assessable  units  (or 
alternative  under  paragraph  E.l.a.,  above.  This  inventory  should  be  an  aspect  of  every  DoD 
Component’s  Management  Control  Plan  (MCP),  under  paragraph  L,  subparagraph  “Agency  Im¬ 
plementation”  in  reference  (c),  and  should  be  reviewed  and  updated  annually.  AU  elements  of 
each  DoD  Component  should  be  contained  in  one  or  more  assessable  units  (or  equivalent).  The 
MCP  shall  be  linked  to  activities  conducted  under  0MB  Circulars  A- 127  and  A-130  (references 
(d)  and  (e)). 

c.  Evaluate  the  effectiveness  of  its  MCs  through  a  process  or  mechanism  determined  by 
each  DoD  Component  to  meet  its  specific  requirements.  These  evaluations  shall  be  consistent 
with  the  guidance  contained  in  references  (a)  and  (c).  This  process  should  maximize  the  use  of 
already  existing  management  evaluation  data  and,  to  the  greatest  extent  possible,  minimiy/^.  the 
creation  of  processes  solely  for  the  execution  of  this  program. 

d.  Identify  report,  and  correct  MC  weaknesses.  Each  DoD  Component  shall  establish 
and  maintain  a  process  that  identifies,  reports  and  corrects  MC  weaknesses,  as  follows: 
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(1)  Identification.  The  DoD  Components  may  identify  weaknesses  in  their  MC 
through  a  variety  of  objective  sources.  These  sources  should  include  but  not  be  limited  to: 
audits,  inspections,  investigations,  management  assessments,  creditable  information  of  nongov¬ 
ernmental  origin,  staff  meetings,  and  MC  evaluations. 

(2)  Reporting.  Weaknesses  in  MCs  should  be  reported  if  they  are  deemed  to  be 
material.  Materiality  is  defined  in  enclosure  3.  Furthermore,  OSD  functional  proponents  shall 
identify  systemic  control  weaknesses  in  a  manner  consistent  with  DoD  Directive  5010.38 
(reference  (a)),  subsection  E.  3. 

(3)  Correction.  Circular  A-123  (reference  (c))  requires  DoD  Component  managers 
to  take  timely  and  effective  actions  to  correct  weaknesses  in  their  MCs.  Correcting  MC  weak¬ 
nesses  is  an  integral  part  of  management  accountability.  Tracking  corrective  actions  should  be 
commensurate  with  the  severity  of  the  weakness.  Corrective  action  plans  should  be  developed  for 
all  material  weaknesses,  and  progress  in  implementing  these  plans  should  be  periodically  assessed 
and  reported  to  management.  A  determination  that  a  material  weakness  has  been  corrected 
should  be  made  only  when  sufficient  actions  have  been  taken  and  the  desired  results  achieved. 

The  last  milestone  in  each  corrective  action  plan  shall  include  correction  validation. 

e.  Senior  Management  Council.  Reference  (c)  encourages  use  of  senior  management 
councils  as  a  forum  for  assessing  and  monitoring  MC  Program  efforts.  The  DoD  Components 
are  encouraged  to  establish  their  own  senior  management  council. 

f.  Annual  Statement  of  Assurance.  The  DoD  Components  shall  submit  an  annual  state¬ 
ment  of  assurance  based  on  a  general  assessment  of  the  effectiveness  of  their  MCs.  This  state¬ 
ment  shall  also  include  material  weaknesses  and  the  plan  to  correct  them,  and  be  consistent  with 
annual  Under  Secretary  of  Defense  (Comptroller)  (USD(C))  guidance  about  the  content  and 
structure  of  the  statement.  The  statement  must  be  signed  by  the  Head  of  the  DoD  Component  or 
the  principal  deputy,  and  submitted  to  the  Secretary  of  Defense  by  November  15  of  each  year  or 
an  ^temative  date  if  required  by  the  annual  guidance. 

F.  INFORMATION  REQUIREMENTS 

1 .  Under  3 1  U.S.C.  35 12  (reference  (b)),  the  Secretary  of  Defense  is  required  to  submit  a 
statement  to  the  President  and  the  Congress  addressing  whether  the  Department  of  Defense  has 
established  an  MC  Program  consistent  with  the  requirements  of  reference  (c),  and  whether  this 
program  provides  reasonable  assurance  that  it  meets  the  Federal  Managers’  Financial  Integrity 
Act  objectives  under  reference  (b),  as  outlined  in  reference  (a),  subsections  D.l.  through  D.5.  The 
statement  may  be  subjected  to  a  review  by  the  Senior  Financial  Management  Oversight  Council 
(reference  (f))  before  it  is  provided  to  the  Secretary  of  Defense. 

2.  The  required  DoD  Component  annual  statement  of  assurance  shall  be  based  on  a  general 
assessment  of  MCs  conducted  in  accordance  with  foregoing  guidance  and  shall  consider  MC 
weaknesses  disclosed  by  aU  sources,  including:  management  studies;  DoD  Component  audits, 
inspections,  investigations,  or  internal  review  reports;  and  IG,  DoD,  and  General  Accounting  Of- 
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fice  reports.  The  statement,  signed  by  the  DoD  Component  Head,  or  principal  deputy,  shall  be 
submitted  to  the  Secretary  of  Defense  by  November  15  of  each  year  in  the  format  provided  by 
annual  USD(C)  guidance.  Additional  copies  of  the  statement  and  accompanying  reports  shall  be 
furnished  to  the  USD(C);  the  quantity  of  this  submission  will  be  contained  in  the  annual  guidance 
provided  by  the  Office  of  the  USD(C)  (OUSD(C)).  The  submission  shall  be  based  on,  but  not 
limited  to,  the  requirements  of  the  0MB  Memorandum  (reference  (g)),  as  modified  by  the 
OUSD(C)  and  include  the  following: 

a.  A  cover  memorandum,  signed  by  the  Head  of  the  DoD  Component  or  the  principal 
deputy,  providing  the  organization’s  senior  management  assessment  as  to  whether  there  is  reason¬ 
able  assurance  that  the  organization's  MCs  are  in  place  and  operating  effectively.  Under  0MB 
Circular  A- 123  (reference  (c)),  this  statement  of  assurance  must  take  one  of  three  forms: 

(1)  An  unqualified  statement  of  assurance  ('1  have  reasonable  assurance  that..."). 
Each  unqualified  statement  must  have  a  firm  basis  for  that  position,  which  will  be  summarized  in 
the  cover  memorandum.  A  more  extensive  explanation  of  that  position  must  be  clearly  articulated 
m  the  body  of  the  statement. 

(2)  A  qualified  statement  of  assurance  ("I  have  reasonable  assurance  that ...  except 
for...").  The  material  weaknesses  in  MCs  that  preclude  an  unqualified  statement  should  be  cited 
in  the  cover  memorandum. 

(3)  A  negative  statement  ('1  do  not  have  reasonable  assurance  that ...").  The  basis 
for  this  position  should  be  summarized  in  the  cover  memorandum. 

b.  A  description  of  how  the  DoD  Component  evaluation  was  conducted  and  a  statement, 
based  on  that  evaluation,  on  the  reasonable  assurance  achieved. 

c.  Uncorrected  material  weaknesses  (current  year  and  prior  year  disclosures)  and  the 
specific  plans  and  schedules  for  correction.  The  specific  plans  and  schedules  shall  include  the  ac¬ 
tions  that  will  correct  a  weakness.  Although  the  actions  that  should  correct  the  weakness  may  be 
in  development,  the  weaknesses  should  be  reported  and  the  tentative  actions  should  be  disclosed 
in  a  manner  consistent  with  management’s  current  perceptions. 

d.  Material  weaknesses  corrected  in  the  current  year  (current  year  disclosures  and  prior 
year  disclosures  corrected  in  tire  current  year)  and  a  description  of  the  actions  taken.  Each  cor¬ 
rected  material  weakness  will  include,  as  the  last  milestone,  a  validation  milestone  which  evaluates 
and  certifies  the  effectiveness  of  the  corrective  action. 

e.  If  applicable,  a  report  on  the  status  of  accounting  systems'  conformance  with  Circular 
A-127  and  DoD  7(X)0.14-R  (references  (h)  and  (i))  and  Comptroller  General  accounting  princi¬ 
ples,  standards,  and  related  requirements.  (See  DoD  Directive  5010.38,  subsection  D.5  (reference 
(a)).  If  this  requirement  is  not  applicable,  enclose  a  page  with  the  notation  “not  applicable.” 
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f.  Other  disclosures  or  special  presentations,  including  significant  MC  accomplishments, 
that  may  arise  from  time-to-time  due  to  specific  requests  or  inquiries. 

3.  Reports  on  the  MC  Program  have  been  assigned  Report  Control  Symbol  DD-COMP  (AR) 
1618. 

4.  The  Commanders  of  the  Unified  Combatant  Commands  shall  submit  annual  reports  to  the 
Secretary  of  Defense,  and  information  copies  to  the  Chairman  of  the  Joint  Chiefs  of  Staff,  and  the 
USD(C). 

5.  All  information  requirements  shall  be  consistent  with  procedures  established  in  DoD 
Directives  8320.1  and  8910.1  and  DoD  Instruction  7750.7  (references  (j)  through  (1)). 


G.  KFFRCnVEDATE 


Enclosures  -  5 

1.  References 

2.  Definitions  and  Applicable  Concepts 

3.  Guidance  in  Applying  the  Definition  of  Material  Weakness 

4.  MC  Reporting  Categories 

5.  Resources  for  DoD  Component  MC  Program  Development 
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DEFINITIONS  AND  OTHER  APPLICABLE  CQNCJEPTS 


1.  Assessable  Unit.  Any  organizational  functional  (see  enclosure  4),  programmatic  or  other  ap¬ 
plicable  subdivision,  capable  of  being  evaluated  by  MC  assessment  procedures.  An  assessable 
unit  should  be  a  subdivision  of  an  organization  that  ensures  a  reasonable  level  of  span  of  MC  to 
allow  for  adequate  control  analysis.  Assessable  units  usually  have  specific  MCs  that  are  applica¬ 
ble  to  their  responsibilities,  as  well  as  other  guidance  that  has  broad  organizational  application. 
Occasionally,  some  organizational  units  (field  activities  or  offices)  will  have  fundamentally  the 
same  MC  structure  but  be  considered  individual  assessable  units  because  of  geographic  separa¬ 
tion.  Assessable  imits  are  responsible  for  conducting  MC  evaluations. 

2.  Comptroller  General  Standards.  The  twelve  standards  issued  by  the  Comptroller  General  to  be 
applied  by  all  managers  in  the  Federal  Government  in  developing,  establishing  and  maintaining 
MCs  under  GAO  Standards  of  Internal  Control  (reference  (m)). 

3.  Control  Objective.  A  specific  aim,  goal,  condition,  or  level  of  control  established  by  a  man¬ 
ager  for  an  assessable  unit  that  provides  reasonable  assurance  that  the  resources  allocated  to  that 
activity  are  safeguarded  or  protected  adequately  against  waste,  fraud,  or  mismanagement,  and  that 
organizational,  operational  or  administrative  objectives  are  accomplished.  Control  objectives  are 
not  absolutes.  Limiting  factors  such  as  budget  constraints,  statutory  and  regulatory  restrictions, 
staff  limitations,  and  cost-benefits  of  each  control  technique  are  to  be  considered  in  determining 
desired  control  objectives. 

4.  Control  Technique.  Any  form  of  organization  procedure  or  document  flow  that  is  being  relied 
on  to  accomplish  a  control  objective. 

5.  Documentation.  Documentation  for  MC  systems  includes  the  following  two  types  of  written 
materials: 

a.  Review  Documentation.  Shows  the  type  and  scope  of  review,  the  responsible  official,  the 
pertinent  dates  and  facts,  the  key  findings,  and  the  recommended  corrective  actions.  Documenta¬ 
tion  is  adequate  if  the  information  is  understandable  to  a  reasonably  knowledgeable  reviewer. 

b.  System  Documoitation.  Includes  policies  and  procedures,  organizational  charts,  manuals, 
flow  charts,  and  related  written  and  graphic  materials  necessary  to  describe  organizational  struc¬ 
ture,  operating  procedures,  and  administrative  practices;  and  to  communicate  responsibilities  and 
authorities  for  accomplishing  programs  and  activities.  Documentation  of  MC  activities  is  required 
to  the  extent  needed  by  management  to  control  their  operations  effectively  and  may  be  generated 
by  activities  not  specifically  established  to  meet  the  requirements  of  the  MC  Program.  Documen¬ 
tation  of  MCs  is  mandated  by  0MB  Circular  A-123  (reference  (c)). 
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6.  DoD  Functional  Proponent.  The  DoD  staff  Principal  responsible  for  policy  and  oversight  of  a 
particular  functional  area. 

7.  Event  Cycle.  A  series  of  steps  taken  to  get  something  done.  Any  program  or  function  per¬ 
formed  within  an  organization  contains  such  processes  used  to  start  and  perform  related  activities, 
create  necessary  documentation,  and  gather  and  report  related  data. 

8.  General  Control  Environment.  The  environment  in  which  an  event  cycle  operates,  including 
management  attitude;  organization  structure;  personnel  competence;  delegation  of  authority  and 
responsibility;  policies,  procedures,  budgeting,  and  reporting  practices;  and  organizational  checks 
and  balances. 

9.  Management  Control  flVlCl.  Replaces  the  term  Internal  Management  Control  (IMC).  IMC 
was  used  in  earlier  editions  of  this  guidance,  and  has  found  common  usage  throughout  the  DoD 
community.  IMC  is  replaced  in  this  document  by  the  term  “management  control.”  MC  is  a  sys¬ 
tem  of  guidance,  instructions,  regulations,  procedures,  rules  or  other  organization  instructions  in¬ 
tended  to  determine  the  methods  to  be  employed  to  carry  out  mission  or  operational  actions  or 
objectives,  and  ensure  that  programs  achieve  intended  results.  This  plan  of  organization,  meth¬ 
ods,  and  procedures  adopted  by  management  provides  reasonable  assurance  that  the  objectives  of 
31  U.S.C.  3512  (reference  (b))  are  met.  MCs  support  the  effectiveness  and  the  integrity  of  every 
step  of  a  process  and  provide  feedback  to  management;  they  are  the  rules,  procedures,  techniques 
and  devices  employed  by  managers  to  ensure  that  what  should  occur  in  their  daily  operations  does 
occur  on  a  continuing  basis.  Under  0MB  Circular  A-123  (reference  (c)),  “...management  con¬ 
trols  should  be  an  integral  part  of  the  entire  cycle  of  planning,  budgeting,  management,  account¬ 
ing,  and  auditing.  They  should  support  the  effectiveness  and  the  integrity  of  every  step  of  the 
process  and  provide  continual  feedback  to  management.”  See  “Vital  Management  Controls,” 
item  24.,  below. 

10.  Management  Control  (MCI  Evaluation.  A  documented  evaluation  of  the  MCs  of  an  assess¬ 
able  unit  to  determine  whether  adequate  control  techniques  exist  and  are  implemented  to  achieve 
cost-effective  compliance  with  reference  (b).  MC  evaluations  are  of  the  following  two  types: 

a.  Alternative  Management  Control  Review  tAMCRl.  A  process  to  determine  that  the 
control  techniques  are  operating  properly  or  a  process  developed  for  other  organizational  pur¬ 
poses  that  provides  adequate  information  on  the  effectiveness  of  control  techniques.  This  type  of 
process  may  utilize  computer  security  reviews;  quality  assessments,  financial  systems  reviews;  IG, 
GAO  or  DoD  Component  audits,  inspections,  or  investigations;  internal  review  studies;  and  man¬ 
agement  and/or  consulting  reviews.  Such  alternative  reviews  must  assist  in  determining  overall 
compliance,  and,  whenever  possible,  include  testing  of  controls  and  documentation.  The  process 
employed  should  have  some  reasonable  testing  aspect  associated  with  it. 

b-  Management  Control  Review  (MCRl.  Detailed  examination  of  a  system  of  MCs  in  an 
assessable  unit  using  the  methodology  specific  to  that  purpose.  Enclosure  5  provides  an  inventory 
of  materials  that  may  assist  management  in  the  development  of  sound  reviews.  Reviews  should  be 
conducted  only  when  a  reliable  alternative  source  of  information  is  not  available  and  the  review 
produces  otherwise  unavailable  written  materials  documenting  what  was  done  and  what  was 
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found.  (See  definition  5.,  above.)  The  process  employed  should  have  some  reasonable  cost  ef¬ 
fective  testing  aspect  associated  with  it. 

11.  Management  Control  (MCI  Guidelines.  Enclosure  5  presents  suggested  approaches  that  may 
be  adapted  to  meet  DoD  Component  needs.  Any  adaptation  should  remain  in  compliance  with 
0MB  Circular  No.  A- 123  (reference  (c)). 

12.  Management  Control  Plan  (MCPl  A  brief,  written  plan  (updated  as  necessary)  that  indicates 
the  number  of  scheduled  and  accomplished  MC  evaluations,  the  identity  of  DoD  Component  as¬ 
sessable  units  and  progress  toward  accomplishment  of  annual  program  requirements.  The  data 
contained  in,  or  summarized  by,  the  M(ZP  shall  be  consistent  with  information  reported  in  the 
DoD  Component’s  Annual  Statement  of  Assurance.  The  MCP  need  not  be  lengthy  and  any  for¬ 
mat  may  be  used,  so  long  as  it  addresses  MC  evaluations  throughout  the  organization  and  con¬ 
veys,  with  a  reasonable  certainty,  the  knowledge  that  the  objective  has  been  accomplished. 

13.  Management  Control  (MCi  Program.  The  full  scope  of  management  responsibility  as  defined 
by  DoD  Directive  5010.38  (reference  (a))  and  this  Instruction.  That  responsibility  extends  from 
management’s  development  of  effective  MCs,  through  their  evaluation  and  correction  of  defi¬ 
ciencies,  to  the  reporting  requirements  of  this  guidance. 

14.  Management  Control  (MC't  Program  Evaluations.  The  formal  effort  of  an  organization  to 
ensure  that  MC  systems  are  working  effectively,  including  the  reporting  of  findings  and  conclu¬ 
sions  to  seruor  management.  The  DoD  Components  are  encouraged  to  prevent  this  process  from 
becoming  an  isolated  exercise  outside  the  daily  operating  and  management  activities.  Consolidat¬ 
ing  these  evaluations  with  other  evaluative  activities  is  encouraged. 

15.  Management  Control  (MC^  Standards.  Reference  (c)  is  the  most  pertinent  yardstick  for  this 
factor.  However,  0MB  Memorandum,  Circular  A-127,  DoD  7000.14-R,  Statements  of  Federal 
Financial  Accounting  Standards,  GAO  Title  11  Accounting,  and  Sections  3512  and  3515  of  31 
U.S.  C.  (references  (g),  (h),  (i),  (n),  (o)  and  (p))  should  also  play  a  significant  role  in  the  devel¬ 
opment  of  MC  standards,  when  applicable. 

16.  Management  Control  (MCI  System.  The  sum  of  a  DoD  Component's  methods  and  measures 
used  to  achieve  the  MC  objectives  -  both  the  controls  and  the  evaluations  of  those  controls.  It  is 
not  a  separate  system,  but  an  integral  part  of  the  systems  used  to  operate  programs  and  functions. 

17.  Managers  with  Significant  Management  Control  (MO  Responsibilities.  This  includes  top- 
level  managers,  down  through  operational  managers  of  all  programs  and  activities,  in  which  funds, 
property,  and  other  assets  must  be  safeguarded  against  fraud,  waste,  or  mismanagement;  and  in 
which  operations  and  resources  must  be  managed  efficiently  and  effectively.  While  all  managers 
are  expected  to  comply  with  aimual  MC  evaluation  requirements,  the  DoD  Components  may  not 
require  full  participation  of  all  managers  to  adequately  develop  conclusions  regarding  MCs  or  to 
adequately  produce  year-end  reports. 
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18.  Material  Weakness.  Specific  instances  of  noncompliance  with  31  U.S.C.  3512  (reference  (b)) 
of  such  sufficient  importance  to  warrant  reporting  of  the  control  deficiency  to  the  next  higher 
level  of  management.  Such  weaknesses  significantly  impair  or  may  impair  the  fulfillment  of  a 
DoD  Component's  mission  or  operational  objective;  deprive  the  public  of  needed  services;  violate 
statutory  or  regulatory  requirements;  significantly  weaken  safeguards  against  fraud,  waste,  or 
mismanagement  of  funds,  property,  or  other  assets;  or  result  in  a  conflict  of  interest.  (See  enclo¬ 
sure  3  for  further  information.)  MC  weaknesses  should  be  identified  using  one  of  the  15  func¬ 
tional  reporting  categories.  (See  enclosure  4.) 

19.  Reasonable  Assurance.  A  judgment  by  a  DoD  Component  Head  based  upon  all  available  in¬ 
formation  that  DoD  Component  systems  of  MCs  are  operating  as  intended  by  reference  (b). 

20.  Risk.  The  probable  or  potential  adverse  effects  from  inadequate  MCs  that  may  result  in  the 
loss  of  Government  resources  or  cause  an  agency  to  fail  to  accomplish  significant  mission  objec¬ 
tives  through  fraud,  error,  or  mismanagement. 

21.  Senior  Management  Council.  A  committee  or  board  of  senior  functional  officials  convened 
to  advise  the  head  of  an  organization  on  MC  matters,  to  include  the  identification  of  MC  weak¬ 
nesses  that  merit  reporting  as  material  weaknesses.  The  responsibilities  of  the  Coimcil  need  not 
be  devoted  exclusively  to  oversight  of  MCs. 

22.  Systemic  Control  Weakness.  A  systemic  control  weakness  is  one  that  is  recognized  by  an 
affected  OSD  functional  proponent  to  be  occurring  in  several  DoD  Components  because  of  the 
Components’  ineffective  implementation  of  the  OSD  functional  proponent's  guidance  and/or  be¬ 
cause  the  OSD  functional  proponent's  guidance  did  not  adequately  identify  or  define  the  internal 
controls  required. 

23.  Testing.  Procedures  to  determine  through  observation,  examination,  verification,  sampling, 
or  other  procedures  whether  MC  systems  are  working  as  intended  (in  accordance  with  manage¬ 
ment's  MC  objectives). 

24.  Vital  Management  Controls  (MCsI.  These  are  the  MCs  (see  item  9.,  above)  that  are  most 
important  to  the  accomplishment  of  the  mission  or  responsibilities  of  an  assessable  unit.  Non- 
compliance  with  vital  MCs  would  have  imdesiiable  impact  on  the  accomplishment  of  the  assess¬ 
able  unit’s  mission  and  responsibilities  and  require  the  management  of  tihikt  assessable  unit  to  dis¬ 
close  this  noncompliance,  or  its  impact,  to  more  senior  management.  Some  MCs  may  be  classi¬ 
fied  as  “nonvital”  because  minor  noncompliance  would  not  have  a  significant  impact  on  accom¬ 
plishment  of  the  mission  or  responsibilities  of  the  assessable  unit  However,  noncompliance  with 
nonvital  MCs  may  become  significant  if  the  noncompliance  is  extensive  enough  to  warrant  disclo¬ 
sure  of  this  noncompliance,  or  its  impact,  to  more  senior  management.  MCs  may  be  considered 
vital  at  one  organizational  level,  but  not  at  another  or  more  senior  level.  Classification  of  MCs  as 
vital  or  nonvital  is  a  management  judgment  that  is  subject  to  review  by  members  of  the  audit 
community.  Every  assessable  unit  has  MCs  that  should  be  classified  as  vital  for  that  specific  unit. 
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GJJmANCP.  TN  APPT  .YTNG  THE  DEFINITION  OF  MATERIAL  WEAKNESS 

A.  A  MATERIAL  WEAKNESS  MUST  SATISFY  TWO  CONDITIONS: 

1 .  It  must  be  a  condition  in  which  MCs,  or  compliance  with  them,  do  not  provide  reasonable 
assurance  that  the  objectives  of  the  MC  Program  are  being  met.  In  effect,  the  weakness  results 
from  MCs  that  are  not  in  place,  not  used  or  not  adequate. 

2.  It  must  be  a  condition  that  requires  the  attention  of  the  next  higher  level  of  management. 

As  with  many  other  aspects  of  this  program,  whether  a  weakness  is  material  enough  to  warrant 
reporting  to  a  level  higher  than  that  at  which  it  was  discovered  shall  always  be  a  management 
judgment.  Fundamentally,  managers  should  consider  reporting  a  weakness  to  the  next  higher 
level  if  the  participation  of  management  at  a  higher  level  is  required  to  help  resolve  the  problem 
or,  although  the  problem  can  be  resolved  at  the  lower  level,  it  is  serious  enough,  in  the  judgment 
of  the  manager  with  the  control  weakness,  to  bring  to  the  attention  of  higher  level  management  as 
a  point  of  information.  The  additional  yardsticks  provided  in  sections  B.  and  C.,  below,  are  pro¬ 
vided  to  help  managers  understand  the  concept  of  materiality  and  are  not  intended  to  be  determi¬ 
nants  of  materiality. 

B.  DTSCTTSSTQN  OF  MATERIAL  WEAKNESS  DEFINITION  IN  SECTION  A.,  ABOVE 

1.  A  material  weakness  in  the  DoD  system  of  MCs  may  be  due  to  lack  of  an  applicable  con¬ 
trol,  or  more  frequently,  inadequate  compliance  with  existing  controls.  These  controls  deal  with 
all  program,  operational  and  administrative  functions;  they  are  not  limited  to  financial  or  account¬ 
ing  matters.  Because  of  the  size  and  diversity  of  the  Department  of  Defense,  material  weaknesses 
are  considered  at  the  following  four  levels: 

a.  DoD  Level.  When  a  weakness  is  serious  enough  to  merit  OSD  attention  or  exists  in  a 
majority  of  DoD  Components. 

b.  Component  Level.  When  a  weakness  exists  with  unacceptable  frequency  throu^out 
the  DoD  Component,  or  at  one  installation  and/or  activity  requiring  DoD  Component  Head  at¬ 
tention. 


C.  Majnr  Primmand  or  Field  Activity  Level.  When  a  weakness  requires  the  attention  of 
the  Office  of  the  Head  of  a  major  command. 

d.  Tngtallatirtn  or  Activity  Level.  When  a  weakness  requires  the  attention  of  the  Office  of 
the  Head  of  an  installation. 

2.  In  addition  to  the  basic  characteristics  of  a  material  weakness  described  in  section  A.  and 
subsection  B.I.,  above,  the  final  determination  to  categorize  a  MC  weakness  as  material  results 
from  management  judgment  about  the  relative  impact  of  the  weakness.  For  example,  scoring  each 
of  the  following  considerations  as  "significant"  or  "insignificant"  might  help  a  manager  in  deter¬ 
mining  whether  the  absence  of  or  noncompliance  with  a  control  is  a  material  weakness. 
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a.  Actual  or  potential  loss  of  resources. 

b.  Sensitivity  of  the  resources  involved. 

c.  Magnitude  of  funds,  property,  or  other  resources  involved. 

d.  Frequency  of  actual  and/or  potential  loss. 

e.  Current  or  probable  media  interest  (adverse  publicity). 

f.  Current  or  probable  congressional  interest  (adverse  publicity). 

g.  Unreliable  information  causing  unsound  management  decisions. 

h.  Diminished  aedibility  or  reputation  of  management. 

i  Impaired  fulfillment  of  essential  mission  or  operations. 

j.  Violation  of  statutory  or  regulatory  requirements. 

k.  Impact  on  information  security. 

L  Deprived  the  public  of  needed  Government  services. 

3.  Monetary  value  impact  generally  shall  be  considered  material  when  the  weakness  has 
caused  or  might  cause  loss  of  control  over  a  significant  amount  of  resources  for  which  an  organi¬ 
zation  is  responsible  (including  money,  persoimel,  equipment,  etc.) 

4.  Open  findings  on  MCs  from  any  source,  agreed  to  by  management,  are  candidates  for  a 
material  weakness  at  the  applicable  level,  until  all  corrective  actions  are  complete. 

DETERMININGA  MATERIAL  WEAKNESS.  This  determination  is  a  management  judg¬ 
ment  as  to  whether  a  weakness  meets  the  criteria  discussed  in  sections  A.  and  B.,  above.  A 
higher  or  lower  dollar  threshold  may  be  applicable  in  different  contexts,  depending  on  ihe  nature 
and  characteristics  of  the  weakness,  and  the  level  in  the  organization  that  the  problem  is  identified. 
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MC  REPORTING  C  ATEGORffiS 

1.  Research.  Development.  Test,  and  Evaluation.  This  covers  the  basic  project  definition,  ap¬ 
proval,  and  transition  from  basic  research  through  development,  test,  and  evaluation  and  all  DoD 
and  contractor  operations  involved  in  accomplishing  die  project  work,  excluding  the  support 
functions  covered  in  separate  reporting  categories  such  as  Procurement  and  Contract  Administra¬ 
tion. 

2.  Major  Systems  Acquisition.  Covers  items  designated  as  major  systems  and  that  are  subject  to 
the  procedures  of  the  Defense  Acquisition  Board,  the  Military  Services  acquisition  review  coun¬ 
cils,  or  the  Selected  Acquisition  Reporting  System.  DoD  Directive  5(XK).l  (reference  (q))  may  be 
helpful  when  evaluating  a  weakness  for  inclusion  in  this  category. 

3.  Procurement.  Covers  the  decisions  to  purchase  items  and  services  together  with  certain  ac¬ 
tions  to  award  and  amend  contracts  (e.g.,  contractual  provisions,  type  of  contract,  invitation  to 
bid,  independent  Government  cost  estimate,  technical  specifications,  evaluation  and  selection 
process,  pricing,  and  reporting). 

4.  Contract  Administration.  Covers  the  fulfillment  of  contracmal  requirements  including  per¬ 
formance  and  delivery,  quality  control  and  testing  to  meet  specifications,  performance  acceptance, 
hilling  and  payment  controls,  justification  for  contractual  amendments,  and  actions  to  protect  the 
best  interests  of  the  Government. 

5.  Force  Readiness.  Includes  the  operational  readiness  capability  of  combat  and  combat  support 
(both  Active  and  Reserve)  forces,  based  on  analyses  of  the  use  of  resources  to  attain  required 
combat  capability  or  readiness  levels. 

6.  Manufacturing.  Maintenance,  and  Repair.  Covers  the  management  and  operation  of  in-house 
and  contractor-operated  facilities  performing  maintenance  and  repair  of,  and/or  installation  of 
modifications  to  materiel,  equipment,  and  supplies.  Includes  depot  and  arsenal-type  facilities  as 
well  as  intermediate  and  unit  levels  of  military  organizations. 

7.  Supply  Operations.  Encompasses  the  supply  operations  at  the  wholesale  (depot  and  inventory 
control  point)  level  fi'om  the  initial  determination  of  material  requirements  through  receipt,  stor¬ 
age,  issue  reporting,  and  inventory  control  (excluding  the  procurement  of  materials  and  supplies). 
Covers  all  supply  operations  at  retail  (customer)  level,  including  the  accountability  and  control  for 
supplies  and  equipment  of  all  commodities  in  the  supply  accounts  of  all  units  and  organizations 
(excluding  the  procurement  of  material,  equipment,  and  supplies). 

8.  Property  Management.  Covers  constmetion,  rehabilitation,  modernization,  expansion,  im¬ 
provement,  management,  and  control  over  real  and  installed  property,  and  facilities  (both  military 
and  civil  works  constmetion).  Includes  all  phases  of  property  life-cycle  management  from  deter¬ 
mination  of  need  through  disposition.  Also  covers  disposal  actions  for  all  materiel,  equipment, 
and  supplies,  including  the  Defense  Reutilization  and  Marketing  System. 
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9.  Communications  and/or  Intelligence  and/or  Security.  Covers  the  plans,  programs,  operations, 
systems,  and  management  activities  for  accomplishing  the  communications  and  intelligence  mis¬ 
sions.  Includes  safeguarding  classified  resources  but  not  peripheral  assets  and  support  functions 
covered  by  other  reporting  categories.  Also  covers  the  DoD  programs  for  protection  of  classified 
information. 

10.  Information  Technology.  This  area  covers  the  design,  development,  testing,  approval,  de¬ 
ployment,  use,  and  security  of  automated  information  systems  (using  a  combination  of  computer 
hardware,  software,  data  or  telecommunications  that  performs  functions  such  as  coUectmg,  proc¬ 
essing,  storing,  transmitting  or  displaying  information)  and  other  technologies  for  processing 
management  information.  This  includes  requirements  for  justification  of  equipment  and  software. 
DoD  7740. 1-G  (reference  (r))  may  be  helpful  when  evaluating  a  weakness  for  inclusion  in  this 
category. 

11.  Persormel  and/or  Organization  Management.  Covers  authorizations,  recruitment,  training, 
assignment,  use,  development,  and  management  of  military  and  civilian  personnel  of  the  Depart¬ 
ment  of  Defense.  Also  includes  the  operations  of  headquarters  organizations.  Contract  persormel 
are  not  covered  by  this  category. 

12.  Comptroller  and/or  Resource  Management.  Covers  the  budget  process,  finance  and  account¬ 
ing,  cost  analysis,  productivity  and  management  improvement,  and  the  general  allocation  and 
continuing  evaluation  of  available  resources  to  accomplish  mission  objectives.  Includes  pay  and 
allowances  for  all  DoD  persormel  and  all  financial  management  areas  not  covered  by  other  report¬ 
ing  categories,  including  those  in  cormection  with  0MB  Circular  A-76  (reference  (s)). 

13.  Support  Services.  Includes  all  support  service  functions  financed  from  appropriated  funds 
not  covered  by  the  other  reporting  categories,  such  as  healthcare,  veterinary  care,  and  legal  and 
public  affairs  services.  All  nonappropriated  fund  activities  are  also  covered  by  this  category. 

14.  Security  Assistance.  Covers  management  of  DoD  Foreign  Military  Sales,  Grant  Aid,  and  In¬ 
ternational  MUitaiy  Education  and  Training  Programs. 

15.  Other  (Primarily  Transportation').  AH  functional  responsibilities  not  contained  in  the  previ¬ 
ously  noted  categories  (above),  including  management  and  use  of  land,  sea,  and  air  transportation 
for  movement  of  personnel,  materiel,  supplies,  and  equipment  using  both  military  and  civilian 
sources. 
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RESOURCES  FOR  POD  COMPONENT  MC  PROGRAM  DEVELOPMENT 

A.  Headquarters  personnel  responsible  for  the  development  of  the  MC  Program  for  their  organi¬ 
zation  are  encouraged  to  draw  from  the  suggested  readings  provided  at  section  C.  (below). 
Drawing  upon  academic  or  other  professionally  developed  and  tested  MC  evaluation  mechanisms 
for  developing  a  MC  evaluation  strategy  will  assist  management  in  establishing  a  process  that  will 
stand  up  to  evaluation  by  any  DoD  authority  assigned  responsibility  for  assessing  the  quality  of 
said  strategy  (most  specifically,  the  audit  community). 

B.  Internal  controls  can  only  be  effectively  evaluated  within  an  organizational  context;  therefore, 
the  concept  of  identifying  and  subdividing  an  organization  into  assessable  units  appears  to  be  most 
applicable.  However,  other  substantial  conceptual  approaches  may  be  considered  if  its  use  will 
provide  the  desired  result.  Individual  DoD  Components  may  employ  any  substantial  strategy. 
However,  that  strategy  should  not  isolate  the  program  from  other  day-to-day  management  activi¬ 
ties.  The  process  should  not  be  a  limited,  periodic  exercise  that  lacks  management  participation 
or  leaves  the  final  assessment  of  the  quality  of  MCs  to  non-management  personnel. 

C.  The  following  is  a  nonexclusive  list  of  suggested  readings  (other  authoritative  sources  may  be 
used)  that  may  be  helpful  in  the  development  of  an  effective  MC  Program  (the  list  is  not  an  ex¬ 
clusive  list): 

1 .  Arthur  Andersen  &  Co. ,  “Guide  for  Studying  and  Evaluating  Internal  Controls  in  the  Fed¬ 
eral  Government,”  Revised,  August  1986 

2.  Robert  N.  Anthony,  John  Dearden,  and  Vijay  Govindarajan,  “Management  Control  Sys¬ 
tems,”  Seventh  Edition  (Homewood,  IL  and  Boston,  MA,  Irwin,  1992) 

3.  Committee  of  Sponsoring  Organizations  of  the  Treadway  Commission  (COSO),  “Internal 
Control  -  Integrated  Framework,”  Coopers  &  Lybrand,  September  1992,  Volumes  1-4 

4.  Lawrence  B.  Sawyer,  ‘Elements  of  Management-Oriented  Auditing”  (Altamonte  Springs, 
FL:  Instituteofintemal  Auditors,  1983) 

5.  Hershel  M.  Anderson  (et  al.),  edited  by  Grant  W.  Newton,  “fritemal  Reporting  &  Analy¬ 
sis,”  Second  Edition  (Marina  del  Ray,  CA:  Malibu  Publishing  Company,  1984) 

6.  Edited  by  Jacki  Pritchard  and  Hazel  KemshaU,  “Good  Practice  in  Risk  Assessment  & 
Management”  (Bristol,  PA:  Jessica  Kingsley  Publishers,  1995) 

7.  Dallas  R.  Blevins,  “Internal  Control:  An  Introduction”  (Altamonte  Springs,  FL:  Institute 
of  Internal  Auditors,  1991) 

8.  William  J.  Showalter  and  Jo  Ann  S.  Barefoot,  “The  Compliance  Review  Tool  Kit:  An 
Internal  Control  System  for  Auditing  &  Monitoring”  (Chicago,  BL:  Probus  Publishing  Company, 
1995) 
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9.  William  E.  Peny  and  Javier  F.  Kuong,  “How  to  Test  Internal  Control  and  Integrity  in 
Computerized  Systems”  (Wellesley  Hills,  MA:  Management  Advisory  Publications,  1980) 

10.  President’s  Council  on  Management  Improvement,  Committee  on  Organization  and 
Structure,  “Streamlining  Internal  Control  Processes  and  Strengthening  Management  Controls 
With  Less  Effort”  (Washington,  DC:  Diane  Publishing  Company,  1985) 

1 1.  ZabihoUah  Rezaee,  CM  A,  “Implementing  the  COSO  Report,”  “Management  Account¬ 
ing,”  July,  1994,  pp.  35-37 

12.  K.  Raghunandan  and  D.  V.  Rama,  “Management  Reports  After  COSO,”  “Internal  Audi¬ 
tor,”  August,  1994,  pp.  54-59 

13.  Wanda  A.  Wallace  and  G.  Thomas  White,  “  Reporting  on  Internal  Control,”  “Internal 
Auditor,”  August,  1994,  pp.  40-42 

14.  Richard  M.  Steinberg,  “Reaching  Consensus:  The  GAO’s  Acceptance  of  the  COSO  Re¬ 
port,”  “Journal  of  Accountancy,  September,”  1994,  pp.  37-40 

15.  Dana  R.  Hermanson  and  Heather  M.  Hermanson,  “The  Internal  Control  Paradox:  What 
Every  Manger  Should  Know,”  “Review  of  Business,”  Winter  1994,  pp.  29-32 

16.  Institute  of  Management  Accountants,  “Catalog  of  Publications,”  1996 
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